e0610d5d95d7cbc272e8ccfff064f19ccb8dd36afe76b705e2fad2c2649b1be9

Analysis

max time kernel
127s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:01

Target

e0610d5d95d7cbc272e8ccfff064f19ccb8dd36afe76b705e2fad2c2649b1be9.dll
Size

855KB
MD5

47037a189a4607382560bf7d937ed1c0
SHA1

3c5cb6ba890cadd439f7280ec0f679182b776c47
SHA256

e0610d5d95d7cbc272e8ccfff064f19ccb8dd36afe76b705e2fad2c2649b1be9
SHA512

30952fd6edc17eb32c95a538aab09f78436ef424c937b8be97e7ca718d818fda31cadbbb87aa62a212147eca5c1e5e9c43c49a83bee767296d5cfe359c8c6d6d
SSDEEP

24576:uaGC953BSP97ILXqFsB2kc7zZSrESkeaBCxGfovNbj:ujxIL6Pd7lST0qy8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	1140	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1140	940	rundll32.exe	80
PID 940 wrote to memory of 1140	940	rundll32.exe	80
PID 940 wrote to memory of 1140	940	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0610d5d95d7cbc272e8ccfff064f19ccb8dd36afe76b705e2fad2c2649b1be9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0610d5d95d7cbc272e8ccfff064f19ccb8dd36afe76b705e2fad2c2649b1be9.dll,#1
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 600
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1140 -ip 1140
1⤵
PID:384

memory/1140-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1140-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1140-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download